Jeffrey
3bec829396
Also tracks the auth ServiceAccounts and RBAC in Git so a namespace rebuild restores Kubernetes auth on its own.
29 lines
953 B
YAML
29 lines
953 B
YAML
apiVersion: secrets.infisical.com/v1alpha1
|
|
kind: InfisicalSecret
|
|
metadata:
|
|
name: crowdsec-secrets
|
|
namespace: infisical
|
|
spec:
|
|
hostAPI: https://infisical.jsme.be
|
|
resyncInterval: 30
|
|
authentication:
|
|
kubernetesAuth:
|
|
identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
|
|
serviceAccountRef:
|
|
name: infisical-auth
|
|
namespace: infisical
|
|
autoCreateServiceAccountToken: true
|
|
secretsScope:
|
|
projectSlug: "kubernetes"
|
|
envSlug: "prod"
|
|
secretsPath: "/crowdsec"
|
|
recursive: true
|
|
managedSecretReference:
|
|
secretName: crowdsec-secrets
|
|
secretNamespace: crowdsec
|
|
secretType: Opaque
|
|
# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
|
|
# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
|
|
# - CrowdSec LAPI (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
|
|
# - the kdwils envoy bouncer (authenticates to LAPI + AppSec)
|